1,424 reputation
410
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 3 months
seen 8 hours ago

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Nov
25
comment How can I use a VPN to protect my privacy
One also has to be careful of data leakage, aka an application sending GPS coordinates, cause you may be using an anonymous IP address but we know those coordinates (think location in data embedded in a photograph).
Nov
25
comment How can I use a VPN to protect my privacy
As for privacy, it depends on 1. whether the VPN keeps any kind of logs (including just a permanent encryption key) and 2. whether whoever you are actually trying to protect you privacy from can get the VPN to handle such logs and other personally identifiable information.
Nov
24
comment How does changing your password every 90 days increase security?
Even us security guys game the system and use iteratively increasing digits tacked on the end.
Nov
24
comment How does changing your password every 90 days increase security?
100,000? sha-1 is ~7.5 million iterations a second on a single GPU, 100,000 or less seems a little low.
Nov
24
comment Computer team's password change time different from other users?
The only thing it stops is if the password has been compromised, the attacker would not have access in 90 days (unless the attacker changes the password first). Of course, by the time 90 days is up, every piece of software on the system could have a back door in it, and several rogue accounts created. It's highly unlikely the attacker needs to know the password more than once for initial entry.
Nov
24
comment Is 4096 bit good enough to encrypt data?
not to mention, RSA will be really slow, as in I'll have to wait a year for it to encrypt. (for a whole database)
Nov
24
comment can I identify the origin computer for a program?
@maligree possibly, will certainly help, but I wouldn't expect it to a perfect magic bullet. I would check over very carefully the output for anything that could link back.
Nov
24
comment can I identify the origin computer for a program?
Microsoft's compilers like to go further and start signing the applications by default (usually with self signed keys).
Nov
22
comment Should a web application return true http errors?
could 403 instead of 404 when user page doesn't exist too.
Nov
22
comment How can credit cards be encrypted and still be recalled later?
so, the only hope is to get doing IV's right.
Nov
22
comment How can credit cards be encrypted and still be recalled later?
@the.josh as a credit card number is 16 digits long, lets Assume that they were using a block cipher like AES and that the credit card is just 8 bit (1 byte) ansi characters. That's 16*8 == 128 bits which happens to be the block size of AES in the first place so nomatter the block cipher mode it's going to end up a single block.
Nov
22
comment Is it correct to use form field(hidden) for storing Session Token
Another disadvantage/advantage, can't keep the seesion between browser restarts or even browsing somewhere else and back again. And as said, either way, to be secure the code does have to be written properly.
Nov
3
comment How does DNS work?
At the end of the day you could host your own name servers and make them both have a fit ;)
Nov
1
comment How can http data be compromised on a secure network?
MITM bridge on any cable. A pwn2own device is all one needs.
Oct
27
comment Decent programmer looking to learn to Hack
Or there is SQLi and XSS/CSRF which is about breaking into databases and web applications at higher levels.
Oct
27
comment Decent programmer looking to learn to Hack
Full all out binary hacking would be to find vulnerability buffer overflow, integer overflow... Then inject ones own machine code into it after overflowing the variable. Using little tweaks to manage to get predictable memory mapping.
Oct
27
comment Decent programmer looking to learn to Hack
Add learn ASM as well to all the answers below, it depends on the kind of hacking you plan to do.
Oct
27
comment Securely signing a container package
You just modified it, it's still not a solution. It provides no security benefit to code modification, also a hacker could change the code to bypass the signiture check if that's included in the code.
Oct
27
answered Securely signing a container package
Oct
27
comment Securely signing a container package
If one is going to modify the code and change the signature one can easily change the cert in the code as they do it.